Red Hat Product Errata RHSA-2026:50336 - Security Advisory Issued: 2026-08-04 Updated: 2026-08-04 RHSA-2026:50336 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): automation-controller: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) automation-eda-controller: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN (CVE-2026-12383) automation-eda-controller: Authentication bypass in Event-Driven Ansible via forged HTTP header (CVE-2026-18141) automation-gateway-proxy: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) python3.12-aio http: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993) python3.12-daphne: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545) python3.12-pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) python3.12-pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) python3.12-pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) python3.12-pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) python3.12-pillow: Native heap out-of-bounds write (CVE-2026-59197) python3.12-pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) python3.12-pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885) receptor: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section. Solution For details on how to apply this update, refer to Ansible Automation Platform documentation. Affected Products Red Hat Ansible Automation Platform 2.6 for RHEL 10 x86_64 Red Hat Ansible Automation Platform 2.6 for RHEL 10 s390x Red Hat Ansible Automation Platform 2.6 for RHEL 10 ppc64le Red Hat Ansible Automation Platform 2.6 for RHEL 10 aarch64 Red Hat Ansible Automation Platform 2.6 for RHEL 9 x86_64 Red Hat Ansible Automation Platform 2.6 for RHEL 9 s390x Red Hat Ansible Automation Platform 2.6 for RHEL 9 ppc64le Red Hat Ansible Automation Platform 2.6 for RHEL 9 aarch64 Red Hat Ansible Inside 1.4 x86_64 Red Hat Ansible Inside 1.4 s390x Red Hat Ansible Inside 1.4 ppc64le Red Hat Ansible Inside 1.4 aarch64 Red Hat Ansible Developer 1.3 for RHEL 10 x86_64 Red Hat Ansible Developer 1.3 for RHEL 10 s390x Red Hat Ansible Developer 1.3 for RHEL 10 ppc64le Red Hat Ansible Developer 1.3 for RHEL 10 aarch64 Red Hat Ansible Developer 1.3 for RHEL 9 x86_64 Red Hat Ansible Developer 1.3 for RHEL 9 s390x Red Hat Ansible Developer 1.3 for RHEL 9 ppc64le Red Hat Ansible Developer 1.3 for RHEL 9 aarch64 Fixes BZ - 2467822 - CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME BZ - 2482734 - CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens BZ - 2484099 - CVE-2026-34993 aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() BZ - 2484377 - CVE-2026-44545 daphne: daphne: Denial of Service via excessive WebSocket message size BZ - 2484875 - CVE-2026-40898 github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers BZ - 2489127 - CVE-2026-12383 eda-server: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN BZ - 2497452 - CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file BZ - 2497455 - CVE-2026-55380 python-pillow: Pillow: Denial of Service via crafted GD 2.x image file BZ - 2497464 - CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data BZ - 2497466 - CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files BZ - 2500041 - CVE-2026-59886 pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values BZ - 2500043 - CVE-2026-59197 Pillow: Pillow: Native heap out-of-bounds write BZ - 2500380 - CVE-2026-59885 pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER BZ - 2508155 - CVE-2026-18141 aap-gateway: aap-gateway: Authentication bypass in Event-Driven Ansible via forged HTTP header CVEs CVE-2026-12383 CVE-2026-18141 CVE-2026-33811 CVE-2026-34993 CVE-2026-40898 CVE-2026-44545 CVE-2026-48526 CVE-2026-54059 CVE-2026-54060 CVE-2026-55379 CVE-2026-55380 CVE-2026-59197 CVE-2026-59885 CVE-2026-59886 References https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Ansible Automation Platform 2.6 for RHEL 10 SRPM ansible-dev-tools-26.7.2-1.el10ap.src.rpm SHA-256: dfecfae55b59a296d3a5d77b9881b4264342d88b3245b1d5519c97f56a2cc5a3 python-tox-ansible-26.7.1-1.el10ap.src.rpm SHA-256: f850540608df9b833c3e8f48e61cae1eadfc9a562066f08276bb3dabb93db385 receptor-1.6.7-1.el10ap.src.rpm SHA-256: fd9e49694a28e82fc947986e8082bcddf123a18f2c7ae1d9286b2bc0e5e38c6c x86_64 ansible-dev-tools+server-26.7.2-1.el10ap.noarch.rpm SHA-256: 36e8e3e1f6458437d74feb9807876e8309e89aa7a5f1777aa109aa0dca3d2319 ansible-dev-tools-26.7.2-1.el10ap.noarch.rpm SHA-256: 54887d58d9e782ca131b254ede5309fb1a1590dd93639fd1d7a3eda4b920e964 python3-tox-ansible-26.7.1-1.el10ap.noarch.rpm SHA-256: 13047dcd79dbfe07645ee27f9c99902d4f9f3bafc1cfbec26c5ac4a6ccf77696 receptor-1.6.7-1.el10ap.x86_64.rpm SHA-256: 5bfdb99edf0fc0033a99072be84c7e48c0d76f8f698c0bfad10ed3d915a36cd7 receptor-debuginfo-1.6.7-1.el10ap.x86_64.rpm SHA-256: ff1f97d0469b16eca5e7d395ce7d3d2f226cf6e7c3bd664a3df78f6708742d7b receptor-debugsource-1.6.7-1.el10ap.x86_64.rpm SHA-256: dcdbceb5f7cc4ae361b418a27799c159be47157bc0381941b9f4eb9751c67af8 receptorctl-1.6.7-1.el10ap.noarch.rpm SHA-256: cd6a9418929e3db7c6b61b9ca4570c8336a3bdcef395e6da9621786dbf074040 s390x ansible-dev-tools+server-26.7.2-1.el10ap.noarch.rpm SHA-256: 36e8e3e1f6458437d74feb9807876e8309e89aa7a5f1777aa109aa0dca3d2319 ansible-dev-tools-26.7.2-1.el10ap.noarch.rpm SHA-256: 54887d58d9e782ca131b254ede5309fb1a1590dd93639fd1d7a3eda4b920e964 python3-tox-ansible-26.7.1-1.el10ap.noarch.rpm SHA-256: 13047dcd79dbfe07645ee27f9c99902d4f9f3bafc1cfbec26c5ac4a6ccf77696 receptor-1.6.7-1.el10ap.s390x.rpm SHA-256: 391c677abe388aa5d23ec65678ee703683abead633438e35347c9249355afdc8 receptor-debuginfo-1.6.7-1.el10ap.s390x.rpm SHA-256: 1b6b72dd9ffa605747c3481b1df9a578995257e8cbd367c04426ef7d6384199f receptor-debugsource-1.6.7-1.el10ap.s390x.rpm SHA-256: 01ef928832e58eee90a37f3fdc203d068f59136f274cd199aa87c5f6b521f43a receptorctl-1.6.7-1.el10ap.noarch.rpm SHA-256: cd6a9418929e3db7c6b61b9ca4570c8336a3bdcef395e6da9621786dbf074040 ppc64le ansible-dev-tools+server-26.7.2-1.el10ap.noarch.rpm SHA-256: 36e8e3e1f6458437d74feb9807876e8309e89aa7a5f1777aa109aa0dca3d2319 ansible-dev-tools-26.7.2-1.el10ap.noarch.rpm SHA-256: 54887d58d9e782ca131b254ede5309fb1a1590dd93639fd1d7a3eda4b920e964 python3-tox-ansible-26.7.1-1.el10ap.noarch.rpm SHA-256: 13047dcd79dbfe07645ee27f9c99902d4f9f3bafc1cfbec26c5ac4a6ccf77696 receptor-1.6.7-1.el10ap.ppc64le.rpm SHA-256: 848a0575e356cb42366fe733b55ec1a08f93740730456b187404ca3a1648f220 receptor-debuginfo-1.6.7-1.el10ap.ppc64le.rpm SHA-256: 91ff76e630917d2be0974a0c5ed5426777425f2b899dbbc5e13a37f8f1a17c37 receptor-debugsource-1.6.7-1.el10ap.ppc64le.rpm SHA-256: 711b24a9d6ac05d47904384a38779b9114596590b1f06174d8b16ec1b5809656 receptorctl-1.6.7-1.el10ap.noarch.rpm SHA-256: cd6a9418929e3db7c6b61b9ca4570c8336a3bdcef395e6da9621786dbf074040 aarch64 ansible-dev-tools+server-26.7.2-1.el10ap.noarch.rpm SHA-256: 36e8e3e1f6458437d74feb9807876e8309e89aa7a5f1777aa109aa0dca3d2319 ansible-dev-tools-26.7.2-1.el10ap.noarch.rpm SHA-256: 54887d58d9e782ca131b254ede5309fb1a1590dd93639fd1d7a3eda4b920e964 python3-tox-ansible-26.7.1-1.el10ap.noarch.rpm SHA-256: 13047dcd79dbfe07645ee27f9c99902d4f9f3bafc1cfbec26c5ac4a6ccf77696 receptor-1.6.7-1.el10ap.aarch64.rpm SHA-256: 2fdf3afcfc90b47993c8e8afcb564c567d6c6466e74458e09058f76a589fcef5 receptor-debuginfo-1.6.7-1.el10ap.aarch64.rpm SHA-256: 9c95a9ad6f692bc133d1a9112cca362d6d2f50d2c6193abc291dd4a474739194 receptor-debugsource-1.6.7-1.el10ap.aarch64.rpm SHA-256: 3ec839b2c9b8ce72980dc66c0cde54398b191b12d5f86a88e185dd8d82bfc59d receptorctl-1.6.7-1.el10ap.noarch.rpm SHA-256: cd6a9418929e3db7c6b61b9ca4570c8336a3bdcef395e6da9621786dbf074040 Red Hat Ansible Automation Platform 2.6 for RHEL 9